Thursday, March 28, 2013

Threat Intelligence Learning Plan

So over the last few years, there seems to be a trend of non-DIB companies starting to build internal threat intelligence teams and a big spike in security companies offering it as a subscription service. Ten years ago a paid service got you vulnerability alerts, some open source geopolitical information, and dated commodity botnet information. This space has matured quite a bit, even though some providers are simply repackaging free indicator feeds and CVEs as threat intelligence. I think the value proposition is there by using intelligence to reduce the dwell time of an adversary and potentially on good day thwarting the attacks from the start. I think the formation of strong, sector specific intelligence sharing groups will be key to being better defenders. Having had access in the past to great intelligence via clearances, I know what a huge advantage it is. Hence my strong interest in the subject. At the same time, I have little traditional intelligence analysis experience. Most of what I do is usually indicator centric. Harvest, hunt, rinse and repeat. What I am listing below are some things I would be interested in learning in the format of a pseudo-conference.

Collect
CIF(Collective Intelligence Framework) Workshop - Building and Integrating into Splunk - Kyle Maxwell
MITRE Analyst for a Day - Deploying & Leveraging STIX, CRITS, ChopShop, CybOX, MAEC, CAPEC, TAXII - Reid Gilman
Diggity Workshop - Monitoring the Interwebs for Company Leaks - Stach & Liu
Mining Chinese Media for Intel Gold - Aaron Wade
Building and Safely Maintaining a CyberPersona - iDefense - Yes I used the term Cyber
Intel Provider 360 - Each intel subscription provider has 6 mins to make the case as to why they are the best
Business DevOps - Case Study on getting business buy-in on sharing M&A, divestitures, JV, etc information with IT Security - Has anyone ever done this?
All UR C2 Belong 2ME - Effective Decoding & Monitoring of CN APT Command & Control - Joe Stewart
Automating Collection of APT malware from Public Sandboxes - Wesley McGrew

Analyze
Prickly Panda - How we build behavior-based attribution - Adam Meyers
Night Dragon Redux - Current TTPs of groups targeting the Energy Sector - Dmitri Alperovich
Intel Fusion Lockheed Style - Finding and tracking Campaigns - Mike Cloppert
Conducting Effective Intelligence Analysis - Richards Heuer
The Advanced Non-Chinese Threat - Survey of RU, IR, IL, KP Activity - Patton Adams
Don't be a victim of Badtribution - Billy Leonard
Burning Sykipot - Jaime Blasco
APT1 Where are they now? - Doug Wilson
How a journalist does research and attribution - Brian Krebs

Disseminate
The Making of "The Report" - Mandiant
CEO Round table - What I want in an intelligence team & report - Moderator - Richard Bejtlich

Counter Intelligence
Deceptions Operations - Fooling the Adversary - PaulDotCom
Honeypots that Sting - Alexey Sintsov
Maintaining OPSEC during an incident - Bamm Visscher

Dox2Pwn - Winner of this contest has made the best new attribution as voted by peers of an individual CN PLA or PLA-sponsored computer network operator

No comments:

Post a Comment